Packet Sniffing with Streaming Goes crazy

RouterOS General
1

I’m trying to stream all packets to a machine running ethereal.

The tool will packet sniff to the router just fine (its a rb532), however when i set streaming to a local ip, and set it to monitor one interface, its just starts dumping all kinds of packets as fast as it can to my ethereal machine.

I see this bc it starts dumping 9mbit worth of made up traffic (since the line is always dead after office hours) and maxes out the CPU (to 100%). I cant stop the packetsniffer and the only way to stop it is to reboot the router.

Any ideas? i’ve used packet streaming exactly like this at a different install with no issues.

mt: 2.9.24

EDIT: for what its worth the bogus packets are all icmp destination unreachable (port unrechable) packets..along with the small amount of actual real traffic.

EDIT: also changing the stream TO server still gives the same weird results.

tks..
joe

2

ethereal on windows? ethereal on windows doesn’t open up a port for tzsp so you will be sending an icmp reject for every single packet coming in - not sure why ethereal doesn’t have that really. trafr on unix seems to work better for this. I have used netcat (nc) to open that port on windows and the problem disappeared, you could give that a shot if necessary.

3

ethereal on windows? ethereal on windows doesn’t open up a port for tzsp so you will be sending an icmp reject for every single packet coming in - not sure why ethereal doesn’t have that really. trafr on unix seems to work better for this. I have used netcat (nc) to open that port on windows and the problem disappeared, you could give that a shot if necessary.

4

the thing is this happens even if i point the IP to a non computer as well.